>> It's been reported before, but basically the solution is to not use
>> nss_ldap or pam_ldap but alternative packages nss-pam-ldapd and sssd.
>
> Shouldn't we drop pam_ldap then?

Yup that too.